WordPress
Monthly
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.
Unauthenticated stored cross-site scripting in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.2) lets any remote attacker plant arbitrary JavaScript through the plugin's settlement/IPN notification endpoint, which accepts the 'rel' and 'option' parameters without authentication, nonce validation, or signature verification. Injected payloads are persisted and later rendered unsanitized inside the administrator's settlement error log view in wp-admin, where they execute in the admin's browser session (CVSS 3.1 score 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and can be leveraged to hijack an authenticated administrator session or perform privileged actions. No public exploit code or Proof-of-Concept has been identified at time of analysis, and the flaw is not listed in CISA KEV; the independent assessment notes this is a genuinely actionable issue, with the only real limiting factor being that the payload fires when a store administrator opens the settlement error log - a routine operational action rather than an exotic prerequisite.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Membership (WordPress plugin) versions up to and including 4.8.3, leading to disclosure of a pending member's username and plaintext password, and can activate that member's account without consent. The flaw resides in the resend-activation and email-activation endpoints, which are invoked on frontend init without authentication, nonce, capability, or ownership checks, and accept a recipient address from attacker-controlled POST data. Exploitation requires the target site to have at least one pending, unactivated member account; no public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the GD Rating System plugin for WordPress (all versions up to and including 3.7.1) allows an unauthenticated visitor to inject persistent JavaScript through the 'title' and 'url' Render Args processed by the gdrts_live_handler AJAX action. The action's per-item nonce provides no protection here, because the nonce is emitted in plaintext inside the gdrts-rating-data JSON block on every page that displays a rating item, so any anonymous visitor can harvest it; the injected script then runs in the browser of anyone who later views the poisoned page, giving low-impact confidentiality and integrity effects limited to the client. No public exploit code has been identified at time of analysis, and exploitation requires that the site both runs an affected plugin version and publicly renders at least one rating item.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Stored DOM-based cross-site scripting in the WordPress plugin Visitor Traffic Real Time Statistics (all versions up to and including 8.16) allows unauthenticated remote attackers to inject arbitrary web scripts that execute when a victim later loads the plugin's statistics view. The entry point is the plugin's wp_ajax_nopriv_ahcfree_track_visitor AJAX action, which accepts a forged X-Real-IP HTTP header with no authentication, nonce, or capability check and persists the entity-encoded value verbatim in the database; per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) exploitation is network-reachable and requires no privileges or user interaction at injection time. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so risk here is driven primarily by the trivial unauthenticated injection path rather than by demonstrated in-the-wild abuse.
Privilege escalation in the Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 allows an authenticated Sales Representative-level user who holds both the add_contacts and send_emails capabilities to rebind a contact record to an Administrator's WordPress user ID, then use the v4 email-test endpoint to mint an {auto_login_url} key and obtain a fully authenticated Administrator session. This is a genuine high-priority issue rather than a CVSS-inflated one, but the practical risk is contingent on a site having delegated those non-administrator Groundhogg roles to the attacker; no public exploit identified at time of analysis, and the vendor has released a fix in version 4.9.1.
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Unauthenticated privilege escalation in the Divi Membership plugin for WordPress (versions up to and including 2.2.0) lets any site visitor create a brand-new account with the administrator role and, by also submitting auto_login=on, be logged in as that administrator within the same request - resulting in complete site takeover. The flaw (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) sits in dmem_form_submit_handler(), which derives the new user's role by iterating every WordPress role and calling password_verify() against an attacker-supplied bcrypt hash in the form_id POST parameter, with no whitelist of permitted roles. The only prerequisite is a WordPress nonce, which is publicly emitted on any page that renders the Divi Membership registration form and is therefore readable by any unauthenticated visitor; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Authentication bypass in the WordPress plugin JSON API Auth (all versions up to and including 3.1.2) lets unauthenticated remote attackers harvest a live Administrator logged_in cookie from a cached JSON response and use it to take over the site. The underlying defect sits in the required PI-Media/json-api parent plugin, whose controller-dispatch transient cache is keyed only by URI and query string with HTTP method and POST body ignored, so the authenticated /api/auth/generate_auth_cookie/ response - which embeds a wp_generate_auth_cookie() session cookie directly in its JSON body - is replayed to any subsequent unauthenticated GET, with the plugin's nominal HTTPS enforcement trivially defeated by passing insecure=cool. Our independent assessment keeps the full confidentiality and integrity impact of the vendor vector but treats the access complexity as High (base 8.1 rather than 9.8) because exploitation is opportunistic and conditional: both plugins must be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to the cookie-generation endpoint within the preceding 24-hour transient TTL; no public exploit identified at time of analysis.
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting in the DoFollow Case by Case WordPress plugin (all versions up to and including 3.6.0) allows unauthenticated attackers to inject arbitrary JavaScript through the public comment content field, with the payload persisting and executing in the browser of every subsequent visitor to the affected post once an administrator approves the comment. Exploitation requires the site to have public comment submission enabled and depends on a moderation workflow that approves the tainted comment - no attacker authentication is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and impact is bounded to script execution in victims' browsers with no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but moderate-priority issue whose practical risk is dictated by how permissive a site's comment moderation is.
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Stored cross-site scripting in the MW WP Form plugin for WordPress (all versions up to and including 5.1.7) lets an unauthenticated visitor persist arbitrary JavaScript into a site by submitting a crafted 'post_id' value to a public form. The plugin's CSRF gate (MW_WP_Form_Csrf) is a double-submit cookie check that any visitor can satisfy simply by loading the public form page first, so there is no meaningful barrier to storing the payload; the script then executes whenever a victim - potentially an administrator - later views the injected page. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N by the reporter; assessed as UI:R by our team), this is a genuine but moderate-priority issue rather than a drop-everything emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the GSpeech TTS - WordPress Text To Speech plugin (all versions up to and including 3.22.0) allows unauthenticated attackers to plant script content in a post's comment field that survives WordPress kses sanitization and only becomes executable when the plugin rewrites the rendered HTML at request time. Any visitor who subsequently loads the affected page can have attacker-controlled script run in their browser session, though exposure depends on the site accepting and auto-publishing unauthenticated comments and on GSpeech output being rendered on that page. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); exploitation requirements include the plugin being active and its output-buffer rewrite running on the page displaying the comment.
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and including 5.122.0, allows unauthenticated remote attackers to inject malicious scripts via the Comment Author Name when the image attachment feature (ivole_attach_image) is enabled. The vulnerability arises from insufficient input sanitization and output escaping, and the payload executes when a victim (such as an administrator viewing the reviews list table or a site visitor) loads the affected page. No public exploit code has been identified at time of analysis, but the CVSS 7.2 rating reflects the scope change and low confidentiality/integrity impact; exploitation is conditional on the non-default attachment setting being active.
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) lets unauthenticated attackers inject arbitrary JavaScript through the 'booking_service_qty' parameter of a public booking submission, which is saved inside the resulting order record. The payload is later emitted without escaping in the plugin's wp-admin order management screens, so it executes in the browser of an administrator or other privileged user the moment that order is opened - the plugin's ordinary order-review workflow - giving a scope-changing (S:C) impact despite the injection itself needing no authentication. No public exploit code and no CISA KEV entry are associated with this issue at time of analysis, and the assessed base score is 7.2 (High) under the corrected vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting that a privileged user's review action is the required trigger.
Unauthenticated denial of service in the OMGF WordPress plugin before 6.3.11 allows remote attackers to invoke an action that issues a slow server-side loopback request, exhausting the site's PHP worker pool and potentially making the entire site unavailable. The affected action requires neither authentication nor a valid nonce, so no login or user interaction is needed on a default install. No public exploit identified at time of analysis, and a vendor patch (6.3.11) is available per the advisory.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Account takeover in the WordPress plugin Super Forms - Drag & Drop Form Builder affects every version through 6.3.316: any authenticated user with Subscriber-level access or above can overwrite the password and email address of an arbitrary account, including an administrator, and seize the site. The flaw sits in the Register & Login add-on, whose before_email_success_msg() routine trusts an attacker-supplied user_id in its register_login_action='update' flow and hands it directly to wp_update_user() without any ownership or capability check, while the super_save_form AJAX action that creates the malicious form is equally unprotected; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) reflects that a low-privileged, self-registrable account is the only real prerequisite. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the low bar to entry plus the add-on requirement makes this a genuinely high-priority privilege-escalation flaw rather than an inflated score.
Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
Any WordPress site running the Divi Membership plugin at version 2.3.0 or earlier can be fully taken over by an unauthenticated remote attacker who simply requests a crafted URL, because the plugin unconditionally trusts an attacker-supplied user ID and issues a valid WordPress authentication cookie for it. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-287 improper authentication, exploitation requires no authentication, no user interaction, and no non-default configuration, making it a top-priority issue for affected sites. Notably, the vulnerable code path is registered on every front-end request even if PayPal is disabled or never configured, so the common assumption that an unconfigured payment gateway is harmless does not hold here; no public exploit code has been identified at time of analysis, but the attack is a single GET parameter and requires no tooling.
Unauthenticated stored cross-site scripting in the Visitors Traffic Real Time Statistics Pro WordPress plugin (all versions up to and including 11.22) lets any logged-out visitor write raw HTML/JavaScript into the plugin's traffic database through the page_title parameter of the ahcpro_track_visitor AJAX action, which is deliberately exposed to unauthenticated callers via wp_ajax_nopriv_ahcpro_track_visitor. The injected script stays dormant in the ahc_title_traffic.til_page_title column until an administrator opens the plugin's dashboard, where the 'Traffic by Title' DataTable renders the stored value with innerHTML and no output escaping, executing attacker-controlled JavaScript inside the admin's authenticated session. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; because execution depends on a subsequent admin dashboard view, the attack is passive and deferred rather than immediate, placing it in the medium-priority tier despite the PR:N, UI:N base score of 7.2.
Unauthenticated attackers can obtain a full administrator session on any WordPress site running the DevKit Pro plugin at version 2.3.0 or earlier by setting an attacker-controlled `original_user_id` cookie to a known administrator's user ID, harvesting the switch-back nonce the plugin renders publicly in the site footer for any visitor carrying that cookie, and POSTing it to the plugin's `revert_switch` handler. The root cause is a privilege-check logic error rather than a memory-safety bug: the handler's `verify_nonce_and_capability()` routine checks the `manage_options` capability against the user named in the attacker-supplied cookie instead of against the actual requester, so the subsequent `wp_set_auth_cookie()` call mints an authenticated session for the impersonated administrator, resulting in complete site takeover. Our independent assessment confirms the 9.8 CVSS (AV:N/AC:L/PR:N/UI:N) is genuine and not inflated: exploitation needs only a default install of the affected plugin (version 2.3.0 or lower) with the front-end revert path reachable and a valid administrator user ID such as the default ID 1, with no authentication, user interaction, or non-default configuration barrier; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Authenticated WordPress administrators can abuse the Prime Mover plugin before 2.2.1 to delete arbitrary directories outside the intended extraction path by importing a crafted WPRIME/TAR package whose wprime-config.json contains manipulated tar_root_folder values, ultimately tricking primeMoverDoDelete() into removing critical directories such as wp-admin, which can render the site inoperable. Exploitation requires a high-privileged WordPress administrator account (CVSS PR:H) that performs the package import, so this is not reachable by unauthenticated or low-privileged users; no user interaction beyond the admin's own import action is required. This is a moderate, not top-tier, priority issue: no public exploit code has been identified and there is no CISA KEV listing, though the confidentiality impact is nil while integrity and availability impacts are high, and the vendor has released a fix in version 2.2.1.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
Authenticated subscriber-level attackers can escalate privileges on WordPress sites running ByteCoreStack - MCP Connector for AI Tools versions up to 1.2.2 due to an incorrect privilege assignment (CWE-266). The vulnerability is network-exploitable with low complexity and requires only a subscriber account (CVSS PR:L), with no user interaction, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.
Unauthenticated Insecure Direct Object Reference (IDOR) in the REST API Log WordPress plugin through version 1.7.2 allows remote attackers to read arbitrary log entries by manipulating object identifiers, exposing potentially sensitive REST API request data. The vulnerability is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 7.5 HIGH), and impact is limited to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis; no CISA KEV listing; EPSS risk not provided.
Missing authorization checks in the Gratisfaction WordPress plugin (versions up to and including 4.6.3) allow authenticated Subscriber-level attackers to bypass access controls, potentially leading to high confidentiality impact and limited integrity/availability impact. The flaw is network-reachable with low complexity (CVSS 7.6 HIGH, PR:L) and requires only a low-privileged account, which may be obtainable via open registration on sites using the plugin. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Icegram WordPress plugin through version 3.1.31 allows an authenticated attacker holding only low-level (Contributor-equivalent) privileges to pass crafted serialized data into an unsafe PHP deserialization path, with the potential to trigger a gadget chain that yields high confidentiality, integrity, and availability impact. The flaw is network-reachable, low complexity, and requires no victim interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), and because the vulnerable component is a widely deployable WordPress plugin, any site allowing self-service or delegated content roles expands its exposure surface. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing for this CVE; exploitation depends on an attacker first obtaining a low-privileged account on the target site.
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
Unauthenticated cross-site scripting (XSS) in MaxGalleria versions up to and including 6.5.3 allows remote attackers to inject malicious scripts into web pages viewed by victims, potentially leading to session hijacking, credential theft, or defacement. The plugin must be installed and active on a WordPress site, and exploitation requires a victim to interact with a crafted link (UI:R), making it a high-risk (CVSS 7.1) but interaction-dependent issue. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can delete arbitrary files on any WordPress site running the AcyMailing SMTP Newsletter plugin 11.0.5 or earlier, because the plugin does not properly constrain caller-supplied file paths before deleting them (CWE-22 path traversal). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N shows no authentication, no user interaction and no special configuration is required - only that the vulnerable plugin version is installed and the vulnerable HTTP endpoint is reachable and not firewalled or WAF-blocked. Deletion is bounded by the web server process's filesystem permissions, but that still covers wp-config.php, .htaccess, plugin/theme files and uploads, so successful exploitation leads to site outages, data loss or a path to full site takeover; no public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
Missing authorization in the WP Full Stripe Free WordPress plugin (versions 8.5.6 and earlier) lets remote attackers perform privileged state-changing actions without logging in, because the plugin fails to verify that a request comes from an authorized user. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 HIGH), meaning the flaw is network-reachable and exploitable without authentication, privileges, or user interaction, and its impact is limited to integrity - an attacker can alter data or configuration but, per the vector, cannot read data or cause denial of service. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is tempered mainly by the plugin's niche deployment footprint and the integrity-only impact.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Unauthenticated privilege escalation in the Authorizer WordPress plugin (versions up to and including 3.15.3) allows remote attackers to gain elevated privileges, potentially administrator-level, on affected WordPress sites. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical) and per the vector requires no authentication or user interaction. No public exploit code has been identified at the time of analysis, but the low deployment footprint of the plugin may limit widespread exploitation.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.
Server-side request forgery (SSRF) in LA-Studio Element Kit for Elementor through version 1.6.2 allows remote unauthenticated attackers to make the WordPress server issue arbitrary HTTP(S) requests to internal or external resources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), no authentication or user interaction is required, and the scope change (S:C) with low confidentiality and integrity impact reflects that the attacker can pivot through the server to reach otherwise inaccessible services. No public exploit code or active exploitation is identified at time of analysis; risk is elevated for sites that expose cloud metadata endpoints or internal services to the WordPress host.
Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin).
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.
Unauthenticated stored cross-site scripting in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.2) lets any remote attacker plant arbitrary JavaScript through the plugin's settlement/IPN notification endpoint, which accepts the 'rel' and 'option' parameters without authentication, nonce validation, or signature verification. Injected payloads are persisted and later rendered unsanitized inside the administrator's settlement error log view in wp-admin, where they execute in the admin's browser session (CVSS 3.1 score 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and can be leveraged to hijack an authenticated administrator session or perform privileged actions. No public exploit code or Proof-of-Concept has been identified at time of analysis, and the flaw is not listed in CISA KEV; the independent assessment notes this is a genuinely actionable issue, with the only real limiting factor being that the payload fires when a store administrator opens the settlement error log - a routine operational action rather than an exotic prerequisite.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Membership (WordPress plugin) versions up to and including 4.8.3, leading to disclosure of a pending member's username and plaintext password, and can activate that member's account without consent. The flaw resides in the resend-activation and email-activation endpoints, which are invoked on frontend init without authentication, nonce, capability, or ownership checks, and accept a recipient address from attacker-controlled POST data. Exploitation requires the target site to have at least one pending, unactivated member account; no public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the GD Rating System plugin for WordPress (all versions up to and including 3.7.1) allows an unauthenticated visitor to inject persistent JavaScript through the 'title' and 'url' Render Args processed by the gdrts_live_handler AJAX action. The action's per-item nonce provides no protection here, because the nonce is emitted in plaintext inside the gdrts-rating-data JSON block on every page that displays a rating item, so any anonymous visitor can harvest it; the injected script then runs in the browser of anyone who later views the poisoned page, giving low-impact confidentiality and integrity effects limited to the client. No public exploit code has been identified at time of analysis, and exploitation requires that the site both runs an affected plugin version and publicly renders at least one rating item.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Stored DOM-based cross-site scripting in the WordPress plugin Visitor Traffic Real Time Statistics (all versions up to and including 8.16) allows unauthenticated remote attackers to inject arbitrary web scripts that execute when a victim later loads the plugin's statistics view. The entry point is the plugin's wp_ajax_nopriv_ahcfree_track_visitor AJAX action, which accepts a forged X-Real-IP HTTP header with no authentication, nonce, or capability check and persists the entity-encoded value verbatim in the database; per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) exploitation is network-reachable and requires no privileges or user interaction at injection time. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so risk here is driven primarily by the trivial unauthenticated injection path rather than by demonstrated in-the-wild abuse.
Privilege escalation in the Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 allows an authenticated Sales Representative-level user who holds both the add_contacts and send_emails capabilities to rebind a contact record to an Administrator's WordPress user ID, then use the v4 email-test endpoint to mint an {auto_login_url} key and obtain a fully authenticated Administrator session. This is a genuine high-priority issue rather than a CVSS-inflated one, but the practical risk is contingent on a site having delegated those non-administrator Groundhogg roles to the attacker; no public exploit identified at time of analysis, and the vendor has released a fix in version 4.9.1.
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Unauthenticated privilege escalation in the Divi Membership plugin for WordPress (versions up to and including 2.2.0) lets any site visitor create a brand-new account with the administrator role and, by also submitting auto_login=on, be logged in as that administrator within the same request - resulting in complete site takeover. The flaw (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) sits in dmem_form_submit_handler(), which derives the new user's role by iterating every WordPress role and calling password_verify() against an attacker-supplied bcrypt hash in the form_id POST parameter, with no whitelist of permitted roles. The only prerequisite is a WordPress nonce, which is publicly emitted on any page that renders the Divi Membership registration form and is therefore readable by any unauthenticated visitor; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Authentication bypass in the WordPress plugin JSON API Auth (all versions up to and including 3.1.2) lets unauthenticated remote attackers harvest a live Administrator logged_in cookie from a cached JSON response and use it to take over the site. The underlying defect sits in the required PI-Media/json-api parent plugin, whose controller-dispatch transient cache is keyed only by URI and query string with HTTP method and POST body ignored, so the authenticated /api/auth/generate_auth_cookie/ response - which embeds a wp_generate_auth_cookie() session cookie directly in its JSON body - is replayed to any subsequent unauthenticated GET, with the plugin's nominal HTTPS enforcement trivially defeated by passing insecure=cool. Our independent assessment keeps the full confidentiality and integrity impact of the vendor vector but treats the access complexity as High (base 8.1 rather than 9.8) because exploitation is opportunistic and conditional: both plugins must be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to the cookie-generation endpoint within the preceding 24-hour transient TTL; no public exploit identified at time of analysis.
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting in the DoFollow Case by Case WordPress plugin (all versions up to and including 3.6.0) allows unauthenticated attackers to inject arbitrary JavaScript through the public comment content field, with the payload persisting and executing in the browser of every subsequent visitor to the affected post once an administrator approves the comment. Exploitation requires the site to have public comment submission enabled and depends on a moderation workflow that approves the tainted comment - no attacker authentication is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and impact is bounded to script execution in victims' browsers with no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but moderate-priority issue whose practical risk is dictated by how permissive a site's comment moderation is.
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Stored cross-site scripting in the MW WP Form plugin for WordPress (all versions up to and including 5.1.7) lets an unauthenticated visitor persist arbitrary JavaScript into a site by submitting a crafted 'post_id' value to a public form. The plugin's CSRF gate (MW_WP_Form_Csrf) is a double-submit cookie check that any visitor can satisfy simply by loading the public form page first, so there is no meaningful barrier to storing the payload; the script then executes whenever a victim - potentially an administrator - later views the injected page. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N by the reporter; assessed as UI:R by our team), this is a genuine but moderate-priority issue rather than a drop-everything emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the GSpeech TTS - WordPress Text To Speech plugin (all versions up to and including 3.22.0) allows unauthenticated attackers to plant script content in a post's comment field that survives WordPress kses sanitization and only becomes executable when the plugin rewrites the rendered HTML at request time. Any visitor who subsequently loads the affected page can have attacker-controlled script run in their browser session, though exposure depends on the site accepting and auto-publishing unauthenticated comments and on GSpeech output being rendered on that page. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); exploitation requirements include the plugin being active and its output-buffer rewrite running on the page displaying the comment.
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and including 5.122.0, allows unauthenticated remote attackers to inject malicious scripts via the Comment Author Name when the image attachment feature (ivole_attach_image) is enabled. The vulnerability arises from insufficient input sanitization and output escaping, and the payload executes when a victim (such as an administrator viewing the reviews list table or a site visitor) loads the affected page. No public exploit code has been identified at time of analysis, but the CVSS 7.2 rating reflects the scope change and low confidentiality/integrity impact; exploitation is conditional on the non-default attachment setting being active.
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) lets unauthenticated attackers inject arbitrary JavaScript through the 'booking_service_qty' parameter of a public booking submission, which is saved inside the resulting order record. The payload is later emitted without escaping in the plugin's wp-admin order management screens, so it executes in the browser of an administrator or other privileged user the moment that order is opened - the plugin's ordinary order-review workflow - giving a scope-changing (S:C) impact despite the injection itself needing no authentication. No public exploit code and no CISA KEV entry are associated with this issue at time of analysis, and the assessed base score is 7.2 (High) under the corrected vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting that a privileged user's review action is the required trigger.
Unauthenticated denial of service in the OMGF WordPress plugin before 6.3.11 allows remote attackers to invoke an action that issues a slow server-side loopback request, exhausting the site's PHP worker pool and potentially making the entire site unavailable. The affected action requires neither authentication nor a valid nonce, so no login or user interaction is needed on a default install. No public exploit identified at time of analysis, and a vendor patch (6.3.11) is available per the advisory.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Account takeover in the WordPress plugin Super Forms - Drag & Drop Form Builder affects every version through 6.3.316: any authenticated user with Subscriber-level access or above can overwrite the password and email address of an arbitrary account, including an administrator, and seize the site. The flaw sits in the Register & Login add-on, whose before_email_success_msg() routine trusts an attacker-supplied user_id in its register_login_action='update' flow and hands it directly to wp_update_user() without any ownership or capability check, while the super_save_form AJAX action that creates the malicious form is equally unprotected; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) reflects that a low-privileged, self-registrable account is the only real prerequisite. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the low bar to entry plus the add-on requirement makes this a genuinely high-priority privilege-escalation flaw rather than an inflated score.
Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
Any WordPress site running the Divi Membership plugin at version 2.3.0 or earlier can be fully taken over by an unauthenticated remote attacker who simply requests a crafted URL, because the plugin unconditionally trusts an attacker-supplied user ID and issues a valid WordPress authentication cookie for it. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-287 improper authentication, exploitation requires no authentication, no user interaction, and no non-default configuration, making it a top-priority issue for affected sites. Notably, the vulnerable code path is registered on every front-end request even if PayPal is disabled or never configured, so the common assumption that an unconfigured payment gateway is harmless does not hold here; no public exploit code has been identified at time of analysis, but the attack is a single GET parameter and requires no tooling.
Unauthenticated stored cross-site scripting in the Visitors Traffic Real Time Statistics Pro WordPress plugin (all versions up to and including 11.22) lets any logged-out visitor write raw HTML/JavaScript into the plugin's traffic database through the page_title parameter of the ahcpro_track_visitor AJAX action, which is deliberately exposed to unauthenticated callers via wp_ajax_nopriv_ahcpro_track_visitor. The injected script stays dormant in the ahc_title_traffic.til_page_title column until an administrator opens the plugin's dashboard, where the 'Traffic by Title' DataTable renders the stored value with innerHTML and no output escaping, executing attacker-controlled JavaScript inside the admin's authenticated session. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; because execution depends on a subsequent admin dashboard view, the attack is passive and deferred rather than immediate, placing it in the medium-priority tier despite the PR:N, UI:N base score of 7.2.
Unauthenticated attackers can obtain a full administrator session on any WordPress site running the DevKit Pro plugin at version 2.3.0 or earlier by setting an attacker-controlled `original_user_id` cookie to a known administrator's user ID, harvesting the switch-back nonce the plugin renders publicly in the site footer for any visitor carrying that cookie, and POSTing it to the plugin's `revert_switch` handler. The root cause is a privilege-check logic error rather than a memory-safety bug: the handler's `verify_nonce_and_capability()` routine checks the `manage_options` capability against the user named in the attacker-supplied cookie instead of against the actual requester, so the subsequent `wp_set_auth_cookie()` call mints an authenticated session for the impersonated administrator, resulting in complete site takeover. Our independent assessment confirms the 9.8 CVSS (AV:N/AC:L/PR:N/UI:N) is genuine and not inflated: exploitation needs only a default install of the affected plugin (version 2.3.0 or lower) with the front-end revert path reachable and a valid administrator user ID such as the default ID 1, with no authentication, user interaction, or non-default configuration barrier; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Authenticated WordPress administrators can abuse the Prime Mover plugin before 2.2.1 to delete arbitrary directories outside the intended extraction path by importing a crafted WPRIME/TAR package whose wprime-config.json contains manipulated tar_root_folder values, ultimately tricking primeMoverDoDelete() into removing critical directories such as wp-admin, which can render the site inoperable. Exploitation requires a high-privileged WordPress administrator account (CVSS PR:H) that performs the package import, so this is not reachable by unauthenticated or low-privileged users; no user interaction beyond the admin's own import action is required. This is a moderate, not top-tier, priority issue: no public exploit code has been identified and there is no CISA KEV listing, though the confidentiality impact is nil while integrity and availability impacts are high, and the vendor has released a fix in version 2.2.1.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
Authenticated subscriber-level attackers can escalate privileges on WordPress sites running ByteCoreStack - MCP Connector for AI Tools versions up to 1.2.2 due to an incorrect privilege assignment (CWE-266). The vulnerability is network-exploitable with low complexity and requires only a subscriber account (CVSS PR:L), with no user interaction, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.
Unauthenticated Insecure Direct Object Reference (IDOR) in the REST API Log WordPress plugin through version 1.7.2 allows remote attackers to read arbitrary log entries by manipulating object identifiers, exposing potentially sensitive REST API request data. The vulnerability is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 7.5 HIGH), and impact is limited to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis; no CISA KEV listing; EPSS risk not provided.
Missing authorization checks in the Gratisfaction WordPress plugin (versions up to and including 4.6.3) allow authenticated Subscriber-level attackers to bypass access controls, potentially leading to high confidentiality impact and limited integrity/availability impact. The flaw is network-reachable with low complexity (CVSS 7.6 HIGH, PR:L) and requires only a low-privileged account, which may be obtainable via open registration on sites using the plugin. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Icegram WordPress plugin through version 3.1.31 allows an authenticated attacker holding only low-level (Contributor-equivalent) privileges to pass crafted serialized data into an unsafe PHP deserialization path, with the potential to trigger a gadget chain that yields high confidentiality, integrity, and availability impact. The flaw is network-reachable, low complexity, and requires no victim interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), and because the vulnerable component is a widely deployable WordPress plugin, any site allowing self-service or delegated content roles expands its exposure surface. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing for this CVE; exploitation depends on an attacker first obtaining a low-privileged account on the target site.
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
Unauthenticated cross-site scripting (XSS) in MaxGalleria versions up to and including 6.5.3 allows remote attackers to inject malicious scripts into web pages viewed by victims, potentially leading to session hijacking, credential theft, or defacement. The plugin must be installed and active on a WordPress site, and exploitation requires a victim to interact with a crafted link (UI:R), making it a high-risk (CVSS 7.1) but interaction-dependent issue. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can delete arbitrary files on any WordPress site running the AcyMailing SMTP Newsletter plugin 11.0.5 or earlier, because the plugin does not properly constrain caller-supplied file paths before deleting them (CWE-22 path traversal). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N shows no authentication, no user interaction and no special configuration is required - only that the vulnerable plugin version is installed and the vulnerable HTTP endpoint is reachable and not firewalled or WAF-blocked. Deletion is bounded by the web server process's filesystem permissions, but that still covers wp-config.php, .htaccess, plugin/theme files and uploads, so successful exploitation leads to site outages, data loss or a path to full site takeover; no public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
Missing authorization in the WP Full Stripe Free WordPress plugin (versions 8.5.6 and earlier) lets remote attackers perform privileged state-changing actions without logging in, because the plugin fails to verify that a request comes from an authorized user. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 HIGH), meaning the flaw is network-reachable and exploitable without authentication, privileges, or user interaction, and its impact is limited to integrity - an attacker can alter data or configuration but, per the vector, cannot read data or cause denial of service. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is tempered mainly by the plugin's niche deployment footprint and the integrity-only impact.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Unauthenticated privilege escalation in the Authorizer WordPress plugin (versions up to and including 3.15.3) allows remote attackers to gain elevated privileges, potentially administrator-level, on affected WordPress sites. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical) and per the vector requires no authentication or user interaction. No public exploit code has been identified at the time of analysis, but the low deployment footprint of the plugin may limit widespread exploitation.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.
Server-side request forgery (SSRF) in LA-Studio Element Kit for Elementor through version 1.6.2 allows remote unauthenticated attackers to make the WordPress server issue arbitrary HTTP(S) requests to internal or external resources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), no authentication or user interaction is required, and the scope change (S:C) with low confidentiality and integrity impact reflects that the attacker can pivot through the server to reach otherwise inaccessible services. No public exploit code or active exploitation is identified at time of analysis; risk is elevated for sites that expose cloud metadata endpoints or internal services to the WordPress host.
Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin).